pi-code 1.0.66 → 1.0.67

package/extensions/git-checkpoint.ts

@@ -263,9 +263,11 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
    * matches a pathspec through this, so its removal is staged instead of the stale index
    * entry silently riding along into the next checkpoint. */
   async function committedPaths(): Promise<Set<string>> {
-    const listed = await gitShadow(['ls-tree', '-r', '--name-only', 'HEAD'])
+    // -z: without it git quotes and octal-escapes a non-ASCII name, and the quoted form
+    // is a pathspec that matches nothing, which fails every later add of the session.
+    const listed = await gitShadow(['ls-tree', '-r', '--name-only', '-z', 'HEAD'])
     if (listed.code !== 0) return new Set()
-    return new Set(listed.stdout.split('\n').filter(Boolean))
+    return new Set(listed.stdout.split('\0').filter(Boolean))
   }
 
   /** git rejects the whole pathspec when one entry is ignored, so the ignored paths are

package/extensions/hooks/runners.ts

@@ -163,7 +163,16 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, {
     }
     // On Windows `detached` means DETACHED_PROCESS, which gives a console child its own
     // window; windowsHide keeps every hook invisible (a no-op elsewhere).
-    const child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
+    // node defers only a few spawn errors to the 'error' event; the rest (E2BIG from a
+    // payload past the argv limit) throw here, inside the promise executor, which would
+    // reject the runner and lose every sibling hook's verdict for the event.
+    let child: ReturnType<typeof spawn>
+    try {
+      child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
+    } catch (error) {
+      resolve({ code: 0, stdout: '', stderr: errorMessage(error), timedOut: false, spawnFailed: true })
+      return
+    }
     onChild?.(() => killTree(child))
     let stdout = ''
     let stderr = ''

package/extensions/internal/command-file.ts

@@ -15,10 +15,8 @@
 
 import * as fs from 'node:fs'
 import * as path from 'node:path'
-
-import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
-
 import { CLAUDE_TOOL_MAP } from './claude-tool-names.js'
+import { parseClaudeFrontmatter } from './frontmatter.js'
 import { escapeRegExp } from './values.js'
 
 /** The pi file tools a Claude path rule can govern. */
@@ -291,7 +289,7 @@ export function parseCommandFile(content: string): ParsedCommand {
   // pi's own parser, rather than a hand-rolled one: it reads the YAML shapes Claude
   // command files actually use (flow sequences, block lists, quoted and multi-line
   // values), and a value this misreads is a restriction silently not applied.
-  const { frontmatter, body: raw } = parseFrontmatter(content)
+  const { frontmatter, body: raw } = parseClaudeFrontmatter(content)
   const body = raw.trim()
   const firstLine = body.split('\n').find((line) => line.trim().length > 0) ?? ''
   const disable = frontmatter['disable-model-invocation']

package/extensions/internal/frontmatter.ts

@@ -0,0 +1,59 @@
+/**
+ * Frontmatter of the markdown files Claude Code defines: agents, commands, skills and
+ * output styles.
+ *
+ * pi's parser is strict YAML. Claude's is not: its own /agents generator and Anthropic's
+ * plugins write `description: Use this agent when ... Examples: <example>Context: ...`,
+ * and the command reference documents `argument-hint: [pr-number] [priority]`. Strict
+ * YAML throws on ": " inside a plain scalar and on a second flow sequence, and a throw
+ * costs the whole file, so files that work in Claude Code did not exist here.
+ *
+ * The strict parse is tried first and kept whenever it succeeds. Only when it throws are
+ * the free-text fields quoted and the parse retried. The restriction fields
+ * (allowed-tools, tools, model, ...) are never rewritten: a value misread there is a
+ * restriction silently not applied, so a file whose restrictions do not parse stays
+ * rejected.
+ */
+
+import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
+
+/** Top-level keys whose value is prose. `name` is an identifier and stays strict. */
+const FREE_TEXT_KEYS = new Set(['description', 'argument-hint', 'when_to_use'])
+
+/** A plain scalar, as opposed to a quoted one or a block scalar indicator. */
+const isPlainScalar = (value: string): boolean => value !== '' && !'"\'|>'.includes(value[0])
+
+/** `line` with its free-text plain scalar quoted. A JSON string is a YAML double-quoted
+ * scalar, and its escaping keeps a literal backslash literal, as a plain scalar does. */
+function quoteFreeText(line: string): string {
+  const colon = line.indexOf(':')
+  if (colon === -1 || !FREE_TEXT_KEYS.has(line.slice(0, colon))) return line
+  const value = line.slice(colon + 1).trim()
+  return isPlainScalar(value) ? `${line.slice(0, colon)}: ${JSON.stringify(value)}` : line
+}
+
+/** `content` with the free-text fields of its frontmatter block quoted, or undefined
+ * when there is no block or nothing in it changed. */
+function withQuotedFreeText(content: string): string | undefined {
+  if (!content.startsWith('---')) return undefined
+  const start = content.indexOf('\n') + 1
+  const end = content.indexOf('\n---', start)
+  if (start === 0 || end === -1) return undefined
+  const block = content.slice(start, end)
+  const quoted = block.split('\n').map(quoteFreeText).join('\n')
+  return quoted === block ? undefined : content.slice(0, start) + quoted + content.slice(end)
+}
+
+export function parseClaudeFrontmatter<T extends Record<string, unknown>>(content: string): { frontmatter: T; body: string } {
+  try {
+    return parseFrontmatter<T>(content)
+  } catch (error) {
+    const retry = withQuotedFreeText(content)
+    if (retry === undefined) throw error
+    try {
+      return parseFrontmatter<T>(retry)
+    } catch {
+      throw error
+    }
+  }
+}

package/extensions/internal/project-approval.ts

@@ -23,6 +23,7 @@ import * as path from 'node:path'
 import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
 
 import { ROOT_MARKERS } from './project-root.js'
+import { localSettingsFile } from './settings-chain.js'
 
 /** Project files pi-code acts on that pi's own trust check does not look for. */
 const CLAUDE_SHAPED = [
@@ -52,6 +53,12 @@ const CLAUDE_SHAPED = [
  * home that is in no repository would otherwise walk up into it and report the user's
  * own settings as a project waiting to be approved. */
 export function hasClaudeShapedConfig(cwd: string, home: string = os.homedir()): boolean {
+  // settings.local.json is read from the main checkout, which a worktree's .git file
+  // names and which is a sibling of cwd, never on the walk below. An archive can carry
+  // both ends of that pointer, so the file the chain will read is checked where it is.
+  // At home the file is the user's own, as the walk also holds.
+  const relocated = localSettingsFile(cwd, home)
+  if (path.dirname(path.dirname(relocated)) !== home && fs.existsSync(relocated)) return true
   let currentDir = cwd
   while (true) {
     // The home check comes first: at home itself the .claude found is the user's own.

package/extensions/internal/project-root.ts

@@ -77,9 +77,26 @@ function mainCheckout(root: string): string {
   const marker = `${path.sep}.git${path.sep}worktrees${path.sep}`
   const cut = worktreeDir.lastIndexOf(marker)
   if (cut === -1) return root
+  // The .git file is attacker-writable: an unpacked archive can ship one naming any
+  // directory, and following it as text moved the repository root, and with it the
+  // CLAUDE.md import boundary, to wherever it pointed.
+  if (!pointsBackAt(worktreeDir, dotGit)) return root
   return worktreeDir.slice(0, cut)
 }
 
+/** Whether a worktree's admin directory names `dotGit` as its worktree. git writes
+ * `<main>/.git/worktrees/<name>/gitdir` holding the path of the worktree's `.git` file
+ * (relative to that directory since git 2.48), and nothing outside an archive can be made
+ * to. Compared by realpath: git records the real path, a session cwd may be a symlink. */
+function pointsBackAt(worktreeDir: string, dotGit: string): boolean {
+  try {
+    const [line = ''] = fs.readFileSync(path.join(worktreeDir, 'gitdir'), 'utf-8').split('\n')
+    return fs.realpathSync(path.resolve(worktreeDir, line.trim())) === fs.realpathSync(dotGit)
+  } catch {
+    return false
+  }
+}
+
 function statOf(target: string): fs.Stats | null {
   try {
     return fs.statSync(target)

package/extensions/memory.ts

@@ -277,14 +277,22 @@ export function capIndexForPrompt(index: string): string {
   return `${text}\n(${dropped} more memories not shown; use the memory tool with action "list")`
 }
 
+/** A memory's file name. Letters and digits of any script survive: an ASCII-only slug
+ * reduced every non-Latin name to one fallback, so distinct memories overwrote each
+ * other. `memory` is never produced, because on a case-insensitive filesystem memory.md
+ * is the MEMORY.md index, and writing one destroys the other. Cut by code point, so a
+ * character outside the basic plane is never split. */
 export function slugifyName(name: string): string {
-  return (
-    name
+  const slug = [
+    ...name
       .toLowerCase()
-      .replaceAll(/[^a-z0-9]+/g, '-')
-      .replaceAll(/^-|-$/g, '')
-      .slice(0, 64) || 'memory'
-  )
+      .replaceAll(/[^\p{L}\p{N}]+/gu, '-')
+      .replaceAll(/^-|-$/g, ''),
+  ]
+    .slice(0, 64)
+    .join('')
+  if (slug === '') return 'untitled'
+  return slug === 'memory' ? 'memory-note' : slug
 }
 
 /** The exact key prefix of a memory's index line; matching on a substring would also

package/extensions/output-styles.ts

@@ -22,10 +22,11 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { type ExtensionAPI, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { atomicWriteFile } from './internal/atomic-write.js'
 import { isFlagEnabled } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
+import { parseClaudeFrontmatter } from './internal/frontmatter.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
@@ -54,7 +55,7 @@ function field(frontmatter: Record<string, unknown>, key: string): string {
  * own YAML frontmatter parser, as the command loader uses: a line regex captured to
  * end of line, so `"Terse" # short` came back as `Terse" # short`. */
 export function parseStyle(content: string, fallbackName: string): OutputStyle {
-  const { frontmatter, body } = parseFrontmatter(content)
+  const { frontmatter, body } = parseClaudeFrontmatter(content)
   return {
     name: field(frontmatter, 'name') || fallbackName,
     description: field(frontmatter, 'description'),

package/extensions/session-title.ts

@@ -121,12 +121,14 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
       return // no model, provider error: leave the session untitled (best-effort)
     }
     if (!title) return
-    // A /new during the await moved us to a different session, or a name has since been set;
-    // applying this title now would rename the wrong session, so drop it.
-    if (generation !== startedGeneration || pi.getSessionName?.()) return
     // Post-await ctx getters throw once the session is disposed, and an escaping rejection
-    // from this un-awaited settle can exit pi; apply the title best-effort.
+    // from this un-awaited settle can exit pi; apply the title best-effort. The name read
+    // belongs inside the guard too: pi's CLI never delivers the next session_start to this
+    // instance, so only that throw reveals a session replaced during the call.
     try {
+      // A /new during the await moved us to a different session, or a name has since been
+      // set; applying this title now would rename the wrong session, so drop it.
+      if (generation !== startedGeneration || pi.getSessionName?.()) return
       // pi.setSessionName refreshes the terminal/tab title natively (pi changelog), so a
       // separate ctx.ui.setTitle call would only duplicate that. The guard stays: a
       // disposed session throws from setSessionName post-await, and an escaping rejection

package/extensions/skills.ts

@@ -22,11 +22,12 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { type ExtensionAPI, type ExtensionContext, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
 import { expandCommand, shellExecutionDisabled } from './commands.js'
 import { runAgent } from './internal/agent-run.js'
 import { parseCommandFile } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
+import { parseClaudeFrontmatter } from './internal/frontmatter.js'
 import { managedSettingsFile } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
@@ -103,7 +104,7 @@ function skillAt(root: string, dirName: string): { name: string; filePath: strin
   }
   let name = dirName
   try {
-    const declared = parseFrontmatter<Record<string, unknown>>(content).frontmatter.name
+    const declared = parseClaudeFrontmatter<Record<string, unknown>>(content).frontmatter.name
     if (typeof declared === 'string' && declared.trim()) name = declared.trim()
   } catch {
     // Malformed frontmatter: pi's loader falls back to the directory name too.
@@ -210,7 +211,7 @@ async function expandSkillInvocation(pi: ExtensionAPI, rawText: string, ctx: Ext
   // Claude registers hooks a skill's frontmatter declares when the skill is
   // invoked, for the rest of the session; the hooks extension owns running them,
   // so the declaration is announced over the shared bus.
-  const frontmatter = parseFrontmatter<Record<string, unknown>>(content).frontmatter
+  const frontmatter = parseClaudeFrontmatter<Record<string, unknown>>(content).frontmatter
   const declaredHooks = frontmatter.hooks
   if (declaredHooks !== null && typeof declaredHooks === 'object' && !Array.isArray(declaredHooks)) {
     pi.events?.emit(SKILL_HOOKS_CHANNEL, { skillName: name, hooks: declaredHooks })

package/extensions/subagent/agents.ts

@@ -5,12 +5,13 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works/pi-coding-agent'
+import { getAgentDir, stripFrontmatter } from '@earendil-works/pi-coding-agent'
 // The same mapping a command's `allowed-tools` gets: an agent's `tools:` is the same
 // Claude field, and `--tools` is an exact-name allowlist, so a name pi has no tool for
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { parseClaudeFrontmatter } from '../internal/frontmatter.js'
 import { findModel } from '../internal/model-lookup.js'
 import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
@@ -176,7 +177,7 @@ function agentName(frontmatter: Record<string, unknown>, filePath: string, plugi
 function parseAgentFile(content: string, source: AgentSource, filePath: string, pluginName?: string): AgentConfig | null {
   let parsed: { frontmatter: Record<string, unknown>; body: string }
   try {
-    parsed = parseFrontmatter<Record<string, unknown>>(content)
+    parsed = parseClaudeFrontmatter<Record<string, unknown>>(content)
   } catch (error) {
     // Malformed YAML must not abort discovery for the whole directory, but a silent drop
     // reads as "that agent does not exist", so it is named like the other rejections here.

package/extensions/thinking.ts

@@ -83,8 +83,10 @@ export default function thinkingExtension(pi: ExtensionAPI) {
     const current = pi.getThinkingLevel?.() ?? ctx.thinkingLevel ?? 'off'
     // A keyword only raises reasoning: leave a level already at or above the target.
     if (thinkingRank(current) >= thinkingRank(target)) return
-    override.arm(current, target)
+    // Armed with the level pi actually stored: it clamps to what the model supports, and
+    // an override armed with the level asked for never recognises its own escalation.
     pi.setThinkingLevel?.(target)
+    override.arm(current, pi.getThinkingLevel?.() ?? target)
     // Return nothing so the input is neither consumed nor transformed: Claude keeps
     // the keyword in the prompt.
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.66",
+  "version": "1.0.67",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",